Packstack Installation with Existing External Network / kickstart RHEL7 (CentOS7)

Interested in getting OpenStack up and running within few hours in the easiest possible way? Then Packstack is most probably your friend. Indeed, Packstack is a utility which leverages on Puppet modules to deploy various parts of OpenStack on multiple pre-installed servers over SSH automatically. I've been through a cycle of building/destroying my OpenStack Labs by using this tool and I'm willing to share below a Kickstart File which fully automate such type of Installation (OpenStack using PackStack with an Existing External Network). The initial process on which I built this KickStart Installation is well documented here. My main aim here is to be able to reference a Single Kickstart File during my RHEL/CentOS 7 Installation and have OpenStack Installed and partly configured without manual Intervention (except for a reboot that I preferred not to automate :-) ).

The same Kickstart File can also be used as a Template for RHEL7/CentOS7 (or any other Systemd-based's distribution), especially if there's a need to run some script (or any other program) during the first boot (after OS installation) of the System (see the %post section).
In fact, in this Kickstart File I've edited and created a Systemd service that will run only once after the first boot and delete itself.
I was used to do that on previous RHEL/CentOS (RHEL6...) by leveraging on /etc/rc.local. Though there’s still /etc/rc.local  on RHEL7,It is highly advisable to create own systemd services or udev rules to run scripts during boot instead of using that file.

Note that after the initial reboot, Packstack Configuration Progress can be followed using journalctl (journalctl -f -u pacstack_installation.service) 

Few Things that are specific to this Kickstart:
System Hostname: stiv-opsctr01
System IP: 192.168.0.21/24
System GW: 192.168.0.1 
DNS1 IP: 192.168.0.30
DNS2 IP: 192.168.0.31
PROXY and Install Server (I'm using proxy for Internet Access) : 192.168.0.33


My Kickstart File:

#version=RHEL7 # System authorization information auth --enableshadow --passalgo=sha512 # SELinux configuration selinux --disabled # Use URL to install installation media url --url=http://192.168.0.33/media_centos7u1/ # Use text install text # Run the Setup Agent on first boot firstboot --disable ignoredisk --only-use=sda # Keyboard layouts keyboard --vckeymap=us --xlayouts='us' # System language lang en_US.UTF-8 # Network information network --bootproto=static --device=eno49 --gateway=192.168.0.1 --ip=192.168.0.21 --nameserver=192.168.0.30,192.168.0.31 --netmask=255.255.255.0 --noipv6 --activate --hostname=stiv-opsctr01 network --bootproto=dhcp --device=eno50 --onboot=off --ipv6=auto network --bootproto=dhcp --device=eno51 --onboot=off --ipv6=auto network --bootproto=dhcp --device=eno52 --onboot=off --ipv6=auto # Root password rootpw --iscrypted $6$bimdfXrAP9SXO64e$QzN5e44MdaqVF79IW9DcGGTmAg.6SBp8ktGyw3q0ceu1zp.GBjdEEoU82y8NeEePK6WJpq3Omru.YigsUy. # System timezone timezone Africa/Douala --isUtc --nontp # System bootloader configuration bootloader --append=" crashkernel=auto" --location=mbr --boot-drive=sda # Partition clearing information clearpart --all --initlabel --drives=sda # Disk partitioning information part /boot --fstype="xfs" --ondisk=sda --size=500 part pv.26 --fstype="lvmpv" --ondisk=sda --size=163840 --grow --asprimary volgroup centos --pesize=4096 pv.26 logvol swap --fstype="swap" --size=51200 --name=swap --vgname=centos logvol /home --fstype="xfs" --size=20480 --name=home --vgname=centos logvol / --fstype="xfs" --size=51200 --name=root --vgname=centos --grow %packages @core kexec-tools %end %addon com_redhat_kdump --enable --reserve-mb='auto' %end # Start of the %post section with logging into /root/ks-post.log %post --log=/root/ks-post.log --interpreter=/usr/bin/bash exec < /dev/tty6 > /dev/tty6 chvt 6 clear echo "################################" echo "# Running Post Configuration #" echo "################################" set -x # Make sure no Interface uses NetworkManager and disable it for nic in $(grep -l NM_CONTROLLED.*yes /etc/sysconfig/network-scripts/ifcfg-*) do cp $nic ${nic}.bak sed -i "s/NM_CONTROLLED=yes/NM_CONTROLLED=no/" $nic done systemctl disable NetworkManager # Disable IPv6 in sysctl and yum.conf / it was already disabled on Interface echo "net.ipv6.conf.all.disable_ipv6 = 1" >> /etc/sysctl.conf echo "net.ipv6.conf.default.disable_ipv6 = 1" >> /etc/sysctl.conf sysctl -p echo "ip_resolve=4" >> /etc/yum.conf # Set Proxy (only if needed) dynamically and in /etc/profile as well as yum.conf export http_proxy=http://"192.168.0.33":"3128"/ export https_proxy=http://"192.168.0.33":"3128"/ echo 'export http_proxy=http://"192.168.0.33":"3128"/' >> /etc/profile echo 'export https_proxy=http://"192.168.0.33":"3128"/' >> /etc/profile echo 'proxy=http://192.168.0.33:3128/' >> /etc/yum.conf # Populate hosts file cat <<eof >/etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 # Public IP 192.168.0.21 stiv-opsctr01 stiv-opsctr01.stiv.local EOF # Install my dear vim yum install -y vim # Install Packstack yum install -y https://rdoproject.org/repos/rdo-release.rpm yum install -y openstack-packstack # Run Packstack after the reboot as a Systemd Service cat > /root/packstack_install.sh << EOFPACKSTACK #!/bin/bash set -x # Run Packstack and Configure packstack --allinone --provision-demo=n # Configure External Network cat <<EOF >/etc/sysconfig/network-scripts/ifcfg-br-ex DEVICE=br-ex DEVICETYPE=ovs TYPE=OVSBridge BOOTPROTO=static IPADDR=192.168.0.21 NETMASK=255.255.255.0 GATEWAY=192.168.0.1 DNS1=192.168.0.30 DNS2=192.168.0.31 ONBOOT=yes EOF cat <<eof >/etc/sysconfig/network-scripts/ifcfg-eno49 TYPE=Ethernet NAME=eno49 DEVICE=eno49 ONBOOT=yes TYPE=OVSPort DEVICETYPE=ovs OVS_BRIDGE=br-ex EOF # Go to /root cd /root # Restart Network Service systemctl restart network # Define Logical Name for our physical L2 Segment (extnet) openstack-config --set /etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini ovs bridge_mappings extnet:br-ex # Overcome a packstack deployment bug where only vxlan is made available openstack-config --set /etc/neutron/plugin.ini ml2 type_drivers vxlan,flat,vlan # Restart Services /bin/systemctl restart network.service /bin/systemctl restart neutron-openvswitch-agent.service /bin/systemctl restart neutron-server.service # Create Neutron External Network / unset proxy as API is available on http and allocate Pool IP unset http_proxy unset https_proxy source /root/keystonerc_admin neutron net-create external_network --provider:network_type flat --provider:physical_network extnet --router:external --shared neutron subnet-create --name public_subnet --enable_dhcp=False --allocation-pool=start=192.168.0.200,end=192.168.0.230 --gateway=192.168.0.1 external_network 192.168.0.0/24 # Neutron / Create Router neutron router-create router1 neutron router-gateway-set router1 external_network # Neutron / Create Private Network neutron net-create private_network neutron subnet-create --name private_subnet private_network 192.168.100.0/24 # Neutron / Connect Private Network to Public through the Router neutron router-interface-add router1 private_subnet # Get a Cirrus VM Image that will be used for the test and create Glance Image export http_proxy=http://"192.168.0.33":"3128"/ export https_proxy=http://"192.168.0.33":"3128"/ yum install -y wget wget http://download.cirros-cloud.net/0.3.4/cirros-0.3.4-x86_64-disk.img unset http_proxy unset https_proxy glance image-create --name='cirros image' --is-public=true --container-format=bare --disk-format=qcow2 --file cirros-0.3.4-x86_64-disk.img # Disable packstack_installation service rm '/etc/systemd/system/multi-user.target.wants/pacstack_installation.service' mv -f /etc/systemd/system/pacstack_installation.service /root EOFPACKSTACK # Make /root/packstack_install.sh executable chmod ug+x /root/packstack_install.sh # Create Systemd Services cat > /etc/systemd/system/pacstack_installation.service << EOFSYSTEMD [Unit] Description=Packstack Automated Installation After=sshd.service [Service] Type=oneshot ExecStart=/root/packstack_install.sh > /root/packstack_install.log 2>&1 User=root Group=root [Install] WantedBy=multi-user.target EOFSYSTEMD # Make sure that Systemd Service will be enabled during the next boot ln -s '/etc/systemd/system/pacstack_installation.service' '/etc/systemd/system/multi-user.target.wants/pacstack_installation.service' ###Go back to tty1## exec < /dev/tty1 > /dev/tty1 chvt 1 # End of the %post section %end

References:

https://www.rdoproject.org/Neutron_with_existing_external_network
http://0pointer.de/blog/projects/changing-roots
http://www.freedesktop.org/software/systemd/man/systemd.service.html

Puppet puppetlabs/apache SSL Vhost with Hiera

I've been writing a bunch of Puppet Modules to manage Servers these last time, and one of the thing I figured out(somewhat in a painful way...), is how much I needed to separate my Puppet configuration data which varies a lot from my Puppet Manifest, which I'm willing to keep as much static as possible. So, I naturally shifted from a bunch of <if-else> in some params.pp  to a clean and efficient Hiera Configuration (I read somewhere this great way of summarizing what Hiera is: Hiera lets you separate the "how" from the "what").

Anyway, moving forward in this process, I stumbled upon the re-configuration of some Apache VirtualHosts with Hiera (using the puppetlabs-apache module).  As seen in the example below, I've stivesso.mysite.org configured on both http and https, with http redirected to https. This code worked so well, but as explained above, my aim was to draw a clear line between what it does (configuring http, https server  in such a way that the user will also get to https) and the configuration Data associated (stivesso.mysite.org). Succeeding in that enterprise means that  I can with the same code, configured my others Vhosts Servers in an easy and repeatable way. 

class roles::myweb {

# Include Apache
    class { 'apache':
        default_vhost        => false,
    }
  
    apache::vhost { 'stivesso.mysite.org-nossl':
        servername      => 'stivesso.mysite.org',
        port            => '80',
        docroot         => '/var/www/html/stivesso',
        redirect_status => 'permanent',
        redirect_dest   => 'https://stivesso.mysite.org/'
    }

    apache::vhost { 'stivesso.mysite.org-ssl':
        servername => 'stivesso.mysite.org',
        port       => '443',
        docroot    => '/var/www/html/stivesso',
        ssl        => true,
        ssl_cert   => '/etc/pki/tls/certs/stivesso.crt'
        ssl_key    =>'/etc/pki/tls/certs/stivesso.key'
    }

}

Now, using Hiera would have been quite simple if apache::vhost was a Class, I'd just have added in my Hiera Configuration files directive such as  "apache::vhost::docroot": "/var/www/html/stivesso"...

But apache:vhost isn't a Class, it is a defined type, and Puppet DataBinding only works on Classes. The best way to workaround this and be able to use Hiera is to leverage the Function create_resources. In fact, create_resources is a function which converts a hash into a set of resources and adds them to the catalog. It's taking as argument a resource type (which is exactly what a Defined Type is) and the hash that will be converted to a set of resources. Fortunately, the hiera() lookup function returned Hiera data as a hash.

Below is what my Hiera configuration will look like

[stiv@puppetmaster ~]# cat /etc/puppetlabs/puppet/hieradata/node/myweb01.yaml
---
apache::vhost:
  'stivesso.mysite.org-ssl':
    servername: 'stivesso.mysite.org'
    serveraliases:
        - 'www.stivesso.mysite.org'
    serveradmin: 'stiv@myself.net'
    port: '443'
    docroot: '/var/www/html/stivesso'
    ssl: true
    ssl_cert: '/etc/pki/tls/certs/stivesso.crt'
    ssl_key: '/etc/pki/tls/certs/stivesso.key'
  'stivesso.mysite.org-nossl':
    servername: 'stivesso.mysite.org'
    serveraliases:
        - 'www.stivesso.mysite.org'
    serveradmin: 'stiv@myself.net'
    port: '80'
    docroot: '/var/www/html/stivesso'
    redirect_status: 'permanent'
    redirect_dest: 'https://stivesso.mysite.org/'

And my Puppet Module,

class roles::myweb {

    # Include Apache
    class { 'apache':
        default_vhost        => false,
    }
  
    # Create a hash from Hiera Data with the Vhosts
    $myApacheVhosts = hiera('apache::vhost', {})

    # With Create Resource Converts a hash into a set of resources
    create_resources('apache::vhost', $myApacheVhosts)

}

Well, clean module! The how (module) and the what (data) separated, That seems like what I wanted initially...